This is the official GitHub Repository of the OWASP Mobile Security Testing Guide (MSTG). The MSTG is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). You can also read the MSTG on Gitbook or download it as an e-book.
The MSTG and the MASVS are being adopted by many companies, standards, and various organizations. Want to find out more? Check our users' document listing some of the adopters.
The release 1.0 of the MSTG was published in June 2018. You can get intermediate builds in multiple formats.
Read it on Gitbook. The book is automatically synchronized with the main repo.
Check the releases. Here you can find a PDF, an archive containing the sources, and a DocX document for any given tagged version. Please note that the documents are generated automatically per tag.
Get the book as a printed version. A hardcopy of the book can be ordered via lulu.com. This version of the book is not completely aligned with book printing standards, but we are improving each version. If you recognize any issues or mistakes, even small ones, please raise an issue so we can fix it in the next version.
Get the e-book. The book is available for free, but you can choose to purchase it at a price of your choice if you wish to support our project. All funds raised through sales of the e-book go directly into the project budget and will be used to fund the production of future releases.
$ git clone https://github.com/OWASP/owasp-mstg/ $ cd owasp-mstg/ $ ./tools/docker/run_docker_mstg_generation_on_local.sh
Just check the latest build of the repository at Github actions. This offers you the latest SNAPSHOT version of the document to download.
We are searching for additional authors, reviewers, and editors.
You can start contributing in many different ways:
Please check our Contribution Guide for ideas before you get started.
Please let us know if you'd like to work on an existing open issue before you start working on it. To do so simply write a comment in the issue itself or drop us a line on the Slack channel. This helps us to keep track of what everyone is doing and prevent conflicts.
You can create an OWASP Slack account here: https://owasp.slack.com/join/shared_invite/zt-g398htpy-AZ40HOM1WUOZguJKbblqkw#//
The MSTG is a living document that changes and adapts to the most recent security recommendations every day. While we do want to reach the maximum audience possible, our past experience shows that maintaining translations has proven to be an extremely challenging task. You're free to do forks for your own translations but please understand that any PRs containing them will be declined due to the previously mentioned reasons. However, we strongly encourage further translations of the MASVS as it is much easier to maintain.
A translation of the MSTG into Japanese is available on Github: https://awesomeopensource.com/project/coky-t/owasp-mstg-ja. Thanks to @coky-t for pushing this forward!
Contributors are added to the acknowledgments table based on their contributions logged by GitHub. The list of names is sorted by the number of lines added. Authors are categorized as follows:
Please ping us or create a pull request if you are missing from the table or in the wrong column (note that we update the table frequently, but not in realtime).
If you are willing to write a large portion of the guide and help consistently drive the project forward, you can join as an author. Be aware that you'll be expected to invest lots of time over several months. Contact Sven Schleier (Slack: Sven) or Carlos Holguera (Slack: Carlos) for more information.
Please note that the MSTG focuses primarily on native apps. These are apps built with Java or Kotlin using the Android SDK for Android or built with Swift or Objective-C using the Apple SDKs for iOS. Apps using frameworks such as Nativescript, React-native, Xamarin, Cordova, etc. are not within the main focus of the MSTG. However, some essential controls, such as certificate pinning, have been explained already for some of these platforms.
If you are looking for more security recommendations on this field, feel free to take a look and contribute to the work-in-progress Google sheets based on the compliancy checklist 1.1.2: